@jinn-network/client 0.1.2 → 0.1.3-canary.24b69ea4

package/dist/conformance/checks/source-runtime.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Layer 2 — runtime conformance stubs.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md
+ * §3.2 traced-I/O boundary + §4.10 (V2 TEE integration plug-in points).
+ *
+ * V1 does not implement runtime enforcement (that requires a TEE sandbox with
+ * seccomp-bpf, Linux namespaces, and TLS transcript capture). These stubs
+ * return `skipped: true` in V1 so operators can see the full attested-tier
+ * picture in the ConformanceReport without needing a V2 runtime.
+ *
+ * When V2 ships, replace each stub body with a real implementation that reads
+ * the executor runtime manifest, queries the TEE attestation quote, and
+ * verifies the captured TLS transcripts. See Plan V2 for the full spec.
+ */
+import type { CheckResult, ConformanceContext } from '../types.js';
+/**
+ * Check id: `runtime.seccomp`
+ * Layer: 2
+ *
+ * V1 stub — always skipped. V2 will verify that the executor's seccomp-bpf
+ * policy matches the reference policy in the TEE attestation manifest,
+ * confirming that only the declared system-call surface is available.
+ */
+export declare function checkSeccompPolicy(_ctx: ConformanceContext): CheckResult;
+/**
+ * Check id: `runtime.namespace`
+ * Layer: 2
+ *
+ * V1 stub — always skipped. V2 will verify that the executor runs inside a
+ * Linux user namespace / network namespace policy that matches the declared
+ * TEE isolation profile (no unexpected network interfaces, bind-mounts, etc.).
+ */
+export declare function checkNamespacePolicy(_ctx: ConformanceContext): CheckResult;
+/**
+ * Check id: `runtime.tls-transcript`
+ * Layer: 2
+ *
+ * V1 stub — always skipped. V2 will verify that the captured TLS transcripts
+ * (BoringSSL SSLKEYLOGFILE or eBPF tap) cover all outbound connections and
+ * that every connection's SNI appears in the declared egress allowlist.
+ */
+export declare function checkTlsTranscriptCapture(_ctx: ConformanceContext): CheckResult;

package/dist/conformance/checks/source-runtime.js

@@ -0,0 +1,68 @@
+/**
+ * Layer 2 — runtime conformance stubs.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md
+ * §3.2 traced-I/O boundary + §4.10 (V2 TEE integration plug-in points).
+ *
+ * V1 does not implement runtime enforcement (that requires a TEE sandbox with
+ * seccomp-bpf, Linux namespaces, and TLS transcript capture). These stubs
+ * return `skipped: true` in V1 so operators can see the full attested-tier
+ * picture in the ConformanceReport without needing a V2 runtime.
+ *
+ * When V2 ships, replace each stub body with a real implementation that reads
+ * the executor runtime manifest, queries the TEE attestation quote, and
+ * verifies the captured TLS transcripts. See Plan V2 for the full spec.
+ */
+const V2_NOTE = 'V2 TEE integration plug-in point — see Plan V2';
+/**
+ * Check id: `runtime.seccomp`
+ * Layer: 2
+ *
+ * V1 stub — always skipped. V2 will verify that the executor's seccomp-bpf
+ * policy matches the reference policy in the TEE attestation manifest,
+ * confirming that only the declared system-call surface is available.
+ */
+export function checkSeccompPolicy(_ctx) {
+    return {
+        id: 'runtime.seccomp',
+        layer: 2,
+        passed: true,
+        skipped: true,
+        detail: V2_NOTE,
+    };
+}
+/**
+ * Check id: `runtime.namespace`
+ * Layer: 2
+ *
+ * V1 stub — always skipped. V2 will verify that the executor runs inside a
+ * Linux user namespace / network namespace policy that matches the declared
+ * TEE isolation profile (no unexpected network interfaces, bind-mounts, etc.).
+ */
+export function checkNamespacePolicy(_ctx) {
+    return {
+        id: 'runtime.namespace',
+        layer: 2,
+        passed: true,
+        skipped: true,
+        detail: V2_NOTE,
+    };
+}
+/**
+ * Check id: `runtime.tls-transcript`
+ * Layer: 2
+ *
+ * V1 stub — always skipped. V2 will verify that the captured TLS transcripts
+ * (BoringSSL SSLKEYLOGFILE or eBPF tap) cover all outbound connections and
+ * that every connection's SNI appears in the declared egress allowlist.
+ */
+export function checkTlsTranscriptCapture(_ctx) {
+    return {
+        id: 'runtime.tls-transcript',
+        layer: 2,
+        passed: true,
+        skipped: true,
+        detail: V2_NOTE,
+    };
+}
+//# sourceMappingURL=source-runtime.js.map

package/dist/conformance/checks/source-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-runtime.js","sourceRoot":"","sources":["../../../src/conformance/checks/source-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,OAAO,GAAG,gDAAgD,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO;QACL,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAwB;IAChE,OAAO;QACL,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC"}

package/dist/conformance/checks/source-static.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Layer 2 — static analysis on the source bundle.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md
+ * §3.2 traced-I/O boundary + §4.10 checks (a)–(f).
+ *
+ * All checks in this file apply at the `attested` tier only.
+ * ConformanceContext.sourceBundle is a { files: Map<path, content> }
+ * loaded by the harness from executor.source.bundleCid.
+ *
+ * When ctx.sourceBundle is absent the check returns skipped: true — the
+ * harness omits the source bundle at non-attested tiers, so skipping is
+ * the correct behaviour rather than failing.
+ *
+ * No AST parser — regex grep is adequate and simpler for the enumerated
+ * patterns (see Plan F non-goals).
+ */
+import type { CheckResult, ConformanceContext } from '../types.js';
+/**
+ * Check id: `source.traced-http`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export declare function checkTracedHttpBoundary(ctx: ConformanceContext): CheckResult;
+/**
+ * Check id: `source.mcp-shim`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export declare function checkMcpShimBoundary(ctx: ConformanceContext): CheckResult;
+/**
+ * Check id: `source.subprocess`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export declare function checkSubprocessBoundary(ctx: ConformanceContext): CheckResult;
+/**
+ * Check id: `source.raw-sockets`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export declare function checkRawSockets(ctx: ConformanceContext): CheckResult;
+/**
+ * Check id: `source.dynamic-code`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ * No allowlist — any match is a violation.
+ */
+export declare function checkDynamicCode(ctx: ConformanceContext): CheckResult;
+/**
+ * Check id: `source.artifact-emit`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export declare function checkArtifactEmitPath(ctx: ConformanceContext): CheckResult;

package/dist/conformance/checks/source-static.js

@@ -0,0 +1,311 @@
+/**
+ * Layer 2 — static analysis on the source bundle.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md
+ * §3.2 traced-I/O boundary + §4.10 checks (a)–(f).
+ *
+ * All checks in this file apply at the `attested` tier only.
+ * ConformanceContext.sourceBundle is a { files: Map<path, content> }
+ * loaded by the harness from executor.source.bundleCid.
+ *
+ * When ctx.sourceBundle is absent the check returns skipped: true — the
+ * harness omits the source bundle at non-attested tiers, so skipping is
+ * the correct behaviour rather than failing.
+ *
+ * No AST parser — regex grep is adequate and simpler for the enumerated
+ * patterns (see Plan F non-goals).
+ */
+function scanFiles(files, patterns, allowlist) {
+    const hits = [];
+    for (const [path, content] of files) {
+        if (allowlist.some((a) => path.endsWith(a)))
+            continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            for (const pat of patterns) {
+                if (pat.test(line)) {
+                    hits.push({ path, line: i + 1, text: line.trim() });
+                    break; // one hit per line is enough
+                }
+            }
+        }
+    }
+    return hits;
+}
+function hitsToDetail(hits, limit = 3) {
+    return hits
+        .slice(0, limit)
+        .map((h) => `${h.path}:${h.line}: ${h.text.slice(0, 80)}`)
+        .join('; ');
+}
+function skip(id) {
+    return { id, layer: 2, passed: true, skipped: true };
+}
+// ─── Task 10: traced HTTP boundary ──────────────────────────────────────────
+//
+// Scope §4.10(a): all LLM calls must route through the measured traced-HTTP
+// client wrapper. Flag any file (outside the whitelist) that contains a
+// string literal whose text includes a known LLM provider hostname.
+//
+// Known LLM provider API hosts:
+const LLM_PROVIDER_HOSTS = [
+    'api.anthropic.com',
+    'api.openai.com',
+    'generativelanguage.googleapis.com',
+    'api.cohere.com',
+    'api.mistral.ai',
+];
+const HTTP_WRAPPER_ALLOWLIST = [
+    'src/trajectory/wrappers/http.ts',
+    'src/trajectory/wrappers/llm.ts',
+];
+// Matches any quoted-string literal (', ", `) containing an LLM provider hostname.
+const LLM_HOST_PATTERN = new RegExp(`['"\`][^'"\`]*(?:${LLM_PROVIDER_HOSTS.map((h) => h.replace(/\./g, '\\.')).join('|')})[^'"\`]*['"\`]`);
+/**
+ * Check id: `source.traced-http`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export function checkTracedHttpBoundary(ctx) {
+    const id = 'source.traced-http';
+    if (!ctx.sourceBundle)
+        return skip(id);
+    const hits = scanFiles(ctx.sourceBundle.files, [LLM_HOST_PATTERN], HTTP_WRAPPER_ALLOWLIST);
+    if (hits.length === 0)
+        return { id, layer: 2, passed: true };
+    return {
+        id,
+        layer: 2,
+        passed: false,
+        detail: hitsToDetail(hits),
+    };
+}
+// ─── Task 11: MCP shim boundary ──────────────────────────────────────────────
+//
+// Scope §4.10(b): all MCP calls must go through the measured MCP shim.
+// Flag any file (outside the whitelist) that directly imports
+// @modelcontextprotocol/sdk or instantiates an MCPClient / Client.
+//
+const MCP_WRAPPER_ALLOWLIST = [
+    'src/trajectory/wrappers/mcp.ts',
+];
+const MCP_PATTERNS = [
+    /from\s+['"]@modelcontextprotocol\/sdk/,
+    /require\s*\(\s*['"]@modelcontextprotocol\/sdk/,
+    /new\s+(?:MCPClient|Client)\s*\(/,
+];
+/**
+ * Check id: `source.mcp-shim`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export function checkMcpShimBoundary(ctx) {
+    const id = 'source.mcp-shim';
+    if (!ctx.sourceBundle)
+        return skip(id);
+    const hits = scanFiles(ctx.sourceBundle.files, MCP_PATTERNS, MCP_WRAPPER_ALLOWLIST);
+    if (hits.length === 0)
+        return { id, layer: 2, passed: true };
+    return {
+        id,
+        layer: 2,
+        passed: false,
+        detail: hitsToDetail(hits),
+    };
+}
+// ─── Task 11: subprocess boundary ────────────────────────────────────────────
+//
+// Scope §4.10(c): no subprocess spawns except through the traced wrapper.
+// Flag child_process / execa / Bun.spawn / Deno.Command usage outside the
+// subprocess wrapper file.
+//
+const SUBPROCESS_WRAPPER_ALLOWLIST = [
+    'src/trajectory/wrappers/subprocess.ts',
+];
+const SUBPROCESS_PATTERNS = [
+    /from\s+['"](?:node:)?child_process['"]/,
+    /require\s*\(\s*['"](?:node:)?child_process['"]\s*\)/,
+    /from\s+['"]execa['"]/,
+    /require\s*\(\s*['"]execa['"]\s*\)/,
+    /\bBun\.spawn\s*\(/,
+    /\bDeno\.Command\s*\(/,
+];
+/**
+ * Check id: `source.subprocess`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export function checkSubprocessBoundary(ctx) {
+    const id = 'source.subprocess';
+    if (!ctx.sourceBundle)
+        return skip(id);
+    const hits = scanFiles(ctx.sourceBundle.files, SUBPROCESS_PATTERNS, SUBPROCESS_WRAPPER_ALLOWLIST);
+    if (hits.length === 0)
+        return { id, layer: 2, passed: true };
+    return {
+        id,
+        layer: 2,
+        passed: false,
+        detail: hitsToDetail(hits),
+    };
+}
+// ─── Task 12: raw sockets ─────────────────────────────────────────────────────
+//
+// Scope §4.10(d): no raw TCP/TLS sockets outside measured wrappers.
+// Flag net.createConnection, tls.connect, and their imports outside
+// the socket/HTTP wrapper files.
+//
+const SOCKET_WRAPPER_ALLOWLIST = [
+    'src/trajectory/wrappers/socket.ts',
+    'src/trajectory/wrappers/http.ts',
+];
+const SOCKET_PATTERNS = [
+    /\bnet\.createConnection\s*\(/,
+    /\btls\.connect\s*\(/,
+    /\bdgram\.createSocket\s*\(/,
+    /from\s+['"](?:node:)?net['"]/,
+    /from\s+['"](?:node:)?tls['"]/,
+    /from\s+['"](?:node:)?dgram['"]/,
+    /require\s*\(\s*['"](?:node:)?(?:net|tls|dgram)['"]\s*\)/,
+];
+/**
+ * Check id: `source.raw-sockets`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export function checkRawSockets(ctx) {
+    const id = 'source.raw-sockets';
+    if (!ctx.sourceBundle)
+        return skip(id);
+    const hits = scanFiles(ctx.sourceBundle.files, SOCKET_PATTERNS, SOCKET_WRAPPER_ALLOWLIST);
+    if (hits.length === 0)
+        return { id, layer: 2, passed: true };
+    return {
+        id,
+        layer: 2,
+        passed: false,
+        detail: hitsToDetail(hits),
+    };
+}
+function scanDynamicCode(files) {
+    const hits = [];
+    for (const [path, content] of files) {
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (/\beval\s*\(/.test(line)) {
+                hits.push({ path, line: i + 1, text: line.trim(), reason: 'eval' });
+                continue;
+            }
+            if (/\bnew\s+Function\s*\(/.test(line)) {
+                hits.push({ path, line: i + 1, text: line.trim(), reason: 'new Function' });
+                continue;
+            }
+            if (/\bvm\.runIn[A-Za-z]+\s*\(/.test(line)) {
+                hits.push({ path, line: i + 1, text: line.trim(), reason: 'vm.runIn*' });
+                continue;
+            }
+            // Dynamic import() — check argument.
+            const importMatch = line.match(/\bimport\s*\(\s*([^)]+)\)/);
+            if (importMatch) {
+                const arg = importMatch[1].trim();
+                // Allow: string literals that start with ./ or ../ (relative) or node: (built-in).
+                const isStaticAllowed = /^['"](?:\.\.?\/[^'"]+|node:[^'"]+)['"]$/.test(arg);
+                if (!isStaticAllowed) {
+                    hits.push({
+                        path,
+                        line: i + 1,
+                        text: line.trim(),
+                        reason: 'dynamic import with non-literal or non-relative/node: argument',
+                    });
+                }
+            }
+        }
+    }
+    return hits;
+}
+/**
+ * Check id: `source.dynamic-code`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ * No allowlist — any match is a violation.
+ */
+export function checkDynamicCode(ctx) {
+    const id = 'source.dynamic-code';
+    if (!ctx.sourceBundle)
+        return skip(id);
+    const hits = scanDynamicCode(ctx.sourceBundle.files);
+    if (hits.length === 0)
+        return { id, layer: 2, passed: true };
+    return {
+        id,
+        layer: 2,
+        passed: false,
+        detail: hits
+            .slice(0, 3)
+            .map((h) => `${h.path}:${h.line} [${h.reason}]: ${h.text.slice(0, 80)}`)
+            .join('; '),
+    };
+}
+// ─── Task 13: artifact emit helper ───────────────────────────────────────────
+//
+// Scope §4.10(f): artifact emission must go through the canonical helper
+// (emitArtifact or the packaging module). Flag files that import fs AND
+// look artifact-related (ipfs / uploadToIpfs / .cid) AND call fs.writeFile
+// directly, unless the file is in the allowlist.
+//
+const ARTIFACT_HELPER_ALLOWLIST = [
+    'src/trajectory/artifacts.ts',
+    'src/harnesses/engine/packaging.ts',
+];
+/**
+ * Check id: `source.artifact-emit`
+ * Layer: 2
+ *
+ * Skipped when ctx.sourceBundle is absent.
+ */
+export function checkArtifactEmitPath(ctx) {
+    const id = 'source.artifact-emit';
+    if (!ctx.sourceBundle)
+        return skip(id);
+    const hits = [];
+    for (const [path, content] of ctx.sourceBundle.files) {
+        if (ARTIFACT_HELPER_ALLOWLIST.some((a) => path.endsWith(a)))
+            continue;
+        // Gate 1: file must import fs (otherwise it can't do raw writes).
+        const importsFs = /from\s+['"](?:node:)?fs(?:\/promises)?['"]/.test(content) ||
+            /require\s*\(\s*['"](?:node:)?fs(?:\/promises)?['"]\s*\)/.test(content);
+        if (!importsFs)
+            continue;
+        // Gate 2: file must look like it produces artifacts (IPFS / CID semantics).
+        const looksArtifacty = /\bipfs\b/i.test(content) ||
+            /uploadToIpfs/.test(content) ||
+            /\.cid\b/.test(content) ||
+            /emitArtifact/.test(content);
+        if (!looksArtifacty)
+            continue;
+        // Flag: raw fs write calls inside this artifact-related fs-importing file.
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            if (/\bfs\.(?:writeFile|writeFileSync|createWriteStream)\s*\(/.test(lines[i]) ||
+                /\bwriteFile\s*\(/.test(lines[i])) {
+                hits.push({ path, line: i + 1, text: lines[i].trim() });
+            }
+        }
+    }
+    if (hits.length === 0)
+        return { id, layer: 2, passed: true };
+    return {
+        id,
+        layer: 2,
+        passed: false,
+        detail: hitsToDetail(hits),
+    };
+}
+//# sourceMappingURL=source-static.js.map

package/dist/conformance/checks/source-static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-static.js","sourceRoot":"","sources":["../../../src/conformance/checks/source-static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,SAAS,SAAS,CAChB,KAA0B,EAC1B,QAAkB,EAClB,SAAmB;IAEnB,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpD,MAAM,CAAC,6BAA6B;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAW,EAAE,KAAK,GAAG,CAAC;IAC1C,OAAO,IAAI;SACR,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;SACzD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,EAAU;IACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,oEAAoE;AACpE,EAAE;AACF,gCAAgC;AAChC,MAAM,kBAAkB,GAAG;IACzB,mBAAmB;IACnB,gBAAgB;IAChB,mCAAmC;IACnC,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,iCAAiC;IACjC,gCAAgC;CACjC,CAAC;AAEF,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,oBAAoB,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CACtG,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,SAAS,CACpB,GAAG,CAAC,YAAY,CAAC,KAAK,EACtB,CAAC,gBAAgB,CAAC,EAClB,sBAAsB,CACvB,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE;QACF,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,uEAAuE;AACvE,8DAA8D;AAC9D,mEAAmE;AACnE,EAAE;AACF,MAAM,qBAAqB,GAAG;IAC5B,gCAAgC;CACjC,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,uCAAuC;IACvC,+CAA+C;IAC/C,iCAAiC;CAClC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,MAAM,EAAE,GAAG,iBAAiB,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAEpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE;QACF,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,2BAA2B;AAC3B,EAAE;AACF,MAAM,4BAA4B,GAAG;IACnC,uCAAuC;CACxC,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,wCAAwC;IACxC,qDAAqD;IACrD,sBAAsB;IACtB,mCAAmC;IACnC,mBAAmB;IACnB,sBAAsB;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,MAAM,EAAE,GAAG,mBAAmB,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;IAElG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE;QACF,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,iCAAiC;AACjC,EAAE;AACF,MAAM,wBAAwB,GAAG;IAC/B,mCAAmC;IACnC,iCAAiC;CAClC,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,8BAA8B;IAC9B,qBAAqB;IACrB,4BAA4B;IAC5B,8BAA8B;IAC9B,8BAA8B;IAC9B,gCAAgC;IAChC,yDAAyD;CAC1D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAE1F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE;QACF,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAgBD,SAAS,eAAe,CAAC,KAA0B;IACjD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEtB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACzE,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,mFAAmF;gBACnF,MAAM,eAAe,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5E,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,IAAI,CAAC;wBACR,IAAI;wBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;wBACjB,MAAM,EAAE,gEAAgE;qBACzE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,MAAM,EAAE,GAAG,qBAAqB,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAErD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE;QACF,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,IAAI;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC;KACd,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,MAAM,yBAAyB,GAAG;IAChC,6BAA6B;IAC7B,mCAAmC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,EAAE,GAAG,sBAAsB,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAU,EAAE,CAAC;IAEvB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAEtE,kEAAkE;QAClE,MAAM,SAAS,GAAG,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1E,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,4EAA4E;QAC5E,MAAM,cAAc,GAClB,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YACzB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YACvB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,2EAA2E;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IACE,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACjC,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE;QACF,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/conformance/checks/trajectory-chain.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Layer 1 trajectory check: hash-chain integrity.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md
+ * §3.1 trajectory-signing-granularity row.
+ *
+ * Walks every span in order:
+ *   - span[0].jinn.prevSpanHash must equal computeGenesisHash(envelope.task.cid)
+ *   - span[n].jinn.prevSpanHash must equal computePrevSpanHash(span[n-1])
+ *
+ * Skipped when trajectory is absent.
+ */
+import type { CheckResult, ConformanceContext } from '../types.js';
+/**
+ * Check id: `trajectory.hash-chain`
+ * Layer: 1
+ */
+export declare function checkHashChainIntegrity(ctx: ConformanceContext): CheckResult;

package/dist/conformance/checks/trajectory-chain.js

@@ -0,0 +1,51 @@
+/**
+ * Layer 1 trajectory check: hash-chain integrity.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md
+ * §3.1 trajectory-signing-granularity row.
+ *
+ * Walks every span in order:
+ *   - span[0].jinn.prevSpanHash must equal computeGenesisHash(envelope.task.cid)
+ *   - span[n].jinn.prevSpanHash must equal computePrevSpanHash(span[n-1])
+ *
+ * Skipped when trajectory is absent.
+ */
+import { computeGenesisHash, computePrevSpanHash } from '../../trajectory/hash-chain.js';
+/**
+ * Check id: `trajectory.hash-chain`
+ * Layer: 1
+ */
+export function checkHashChainIntegrity(ctx) {
+    const id = 'trajectory.hash-chain';
+    const layer = 1;
+    const traj = ctx.trajectory;
+    if (!traj)
+        return { id, layer, passed: true, skipped: true };
+    const taskCid = ctx.envelope?.task?.cid;
+    if (!taskCid) {
+        return {
+            id,
+            layer,
+            passed: false,
+            detail: 'envelope.task.cid missing; cannot compute genesis hash',
+        };
+    }
+    const genesis = computeGenesisHash(taskCid);
+    let expectedPrev = genesis;
+    for (let i = 0; i < traj.spans.length; i++) {
+        const span = traj.spans[i];
+        const declared = span.attributes['jinn.prevSpanHash'];
+        if (typeof declared !== 'string' ||
+            declared.toLowerCase() !== expectedPrev.toLowerCase()) {
+            return {
+                id,
+                layer,
+                passed: false,
+                detail: `span[${i}] (${span.spanId}): prevSpanHash ${declared} !== expected ${expectedPrev}${i === 0 ? ' (genesis)' : ''}`,
+            };
+        }
+        expectedPrev = computePrevSpanHash(span);
+    }
+    return { id, layer, passed: true };
+}
+//# sourceMappingURL=trajectory-chain.js.map

package/dist/conformance/checks/trajectory-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trajectory-chain.js","sourceRoot":"","sources":["../../../src/conformance/checks/trajectory-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAKzF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,MAAM,EAAE,GAAG,uBAAuB,CAAC;IACnC,MAAM,KAAK,GAAG,CAAU,CAAC;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAyC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE7D,MAAM,OAAO,GAAI,GAAG,CAAC,QAAoD,EAAE,IAAI,EAAE,GAAG,CAAC;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,YAAY,GAAW,OAAO,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAuB,CAAC;QAE5E,IACE,OAAO,QAAQ,KAAK,QAAQ;YAC5B,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,EACrD,CAAC;YACD,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,mBAAmB,QAAQ,iBAAiB,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE;aAC3H,CAAC;QACJ,CAAC;QAED,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/conformance/checks/trajectory-profile.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Layer 1 trajectory check: span profile conformance.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md §3.1 K6.
+ *
+ * For every span in the trajectory, verifies that the required attributes
+ * declared in SPAN_PROFILE[jinn.span.kind] are present. Unknown span kinds
+ * fail immediately. Reports up to 5 failures to bound message length.
+ *
+ * Skipped when trajectory is absent.
+ */
+import type { CheckResult, ConformanceContext } from '../types.js';
+/**
+ * Check id: `trajectory.span-profile`
+ * Layer: 1
+ */
+export declare function checkSpanProfile(ctx: ConformanceContext): CheckResult;

package/dist/conformance/checks/trajectory-profile.js

@@ -0,0 +1,51 @@
+/**
+ * Layer 1 trajectory check: span profile conformance.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md §3.1 K6.
+ *
+ * For every span in the trajectory, verifies that the required attributes
+ * declared in SPAN_PROFILE[jinn.span.kind] are present. Unknown span kinds
+ * fail immediately. Reports up to 5 failures to bound message length.
+ *
+ * Skipped when trajectory is absent.
+ */
+import { SPAN_PROFILE, validateSpanProfile } from '../../trajectory/span-profile.js';
+/**
+ * Check id: `trajectory.span-profile`
+ * Layer: 1
+ */
+export function checkSpanProfile(ctx) {
+    const id = 'trajectory.span-profile';
+    const layer = 1;
+    const traj = ctx.trajectory;
+    if (!traj)
+        return { id, layer, passed: true, skipped: true };
+    const failures = [];
+    for (let i = 0; i < traj.spans.length; i++) {
+        const span = traj.spans[i];
+        const kind = span.attributes['jinn.span.kind'];
+        if (!kind) {
+            failures.push(`span[${i}] (${span.spanId}) missing jinn.span.kind`);
+            continue;
+        }
+        // Unknown kind check (SPAN_PROFILE only has normative kinds)
+        if (!(kind in SPAN_PROFILE)) {
+            failures.push(`span[${i}] (${span.spanId}) unknown jinn.span.kind: ${kind}`);
+            continue;
+        }
+        const result = validateSpanProfile(span);
+        if (!result.valid) {
+            const missingList = result.missing.join(', ');
+            failures.push(`span[${i}] (${span.spanId}) kind=${kind} missing required attributes: ${missingList}`);
+        }
+    }
+    if (failures.length === 0)
+        return { id, layer, passed: true };
+    return {
+        id,
+        layer,
+        passed: false,
+        detail: failures.slice(0, 5).join('; '),
+    };
+}
+//# sourceMappingURL=trajectory-profile.js.map

package/dist/conformance/checks/trajectory-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trajectory-profile.js","sourceRoot":"","sources":["../../../src/conformance/checks/trajectory-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAKrF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,MAAM,EAAE,GAAG,yBAAyB,CAAC;IACrC,MAAM,KAAK,GAAG,CAAU,CAAC;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAyC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE7D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAuB,CAAC;QAErE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,0BAA0B,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,6BAA6B,IAAI,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,UAAU,IAAI,iCAAiC,WAAW,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE9D,OAAO;QACL,EAAE;QACF,KAAK;QACL,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC"}